feat(agent-platform): core Agent Platform feature branch (all agent platform services)

.dockerignore

@@ -49,6 +49,20 @@
 !services/mcp/types.d.ts
 !services/mcp/worker-configuration.d.ts
 !services/mcp/public
+!services/agents
+!services/agent-ingress
+!services/agent-runner
+!services/agent-janitor
+!services/agent-shared
+!services/agent-tools
+!services/agent-sandbox-host
+!packages/quill
+services/agent-*/node_modules
+services/agent-*/dist
+services/agent-*/.next
+services/agents/node_modules
+services/agents/dist
+services/agent-tests
 !pnpm-lock.yaml
 !pnpm-workspace.yaml
 !pyproject.toml

.env.development

@@ -74,3 +74,10 @@ PERSONHOG_ROLLOUT_PERCENTAGE=100
 
 # Debug
 PYDEVD_DISABLE_FILE_VALIDATION=1
+
+# Agent platform — shared HMAC signing key for trusted-service JWTs.
+# Django mints audience-scoped tokens (agent-ingress.preview for draft
+# previews, agent-janitor.rpc for authoring RPC); ingress + janitor verify
+# against the same key. All three sides MUST agree. See
+# services/agent-shared/src/runtime/internal-jwt.ts.
+AGENT_INTERNAL_SIGNING_KEY=dev-internal-signing-key-do-not-use-in-prod

.flox/env/manifest.toml

@@ -59,6 +59,14 @@ watchman = { pkg-path = "watchman" } # Fast file watching for Django/Celery auto
 DEBUG = "1"
 POSTHOG_SKIP_MIGRATION_CHECKS = "1"
 FLAGS_REDIS_URL = "redis://localhost:6379/1"
+# CH client default DB. Matches docker-compose convention — without it,
+# Django queries unqualified `events` / `log_entries` etc. resolve against
+# the literal `default` DB (where PostHog has no tables) and 500.
+CLICKHOUSE_DATABASE = "posthog"
+# HMAC secret the agent_stack preview-proxy shares with agent-ingress so
+# the JWT minted by Django on every non-live invoke can be verified by
+# ingress. Same value on both sides → live JWT round-trip. Dev only.
+AGENT_PREVIEW_SECRET = "dev-agent-preview-secret-not-for-prod"
 DIRENV_LOG_FORMAT = "" # Disable direnv activation logging (in case direnv is present)
 RUST_LOG = "flox=error,flox_rust_sdk=error,flox_watchdog=error" # Suppress Flox logs only (also set in .envrc for early activation)
 OPENSSL_ROOT_DIR = "$FLOX_ENV"

.github/actions/docker-meta/action.yml

@@ -6,8 +6,9 @@ inputs:
         required: true
         description: 'Image name without registry prefix (e.g., posthog-node, capture, llm-gateway)'
     aws-role-to-assume:
-        required: true
-        description: 'AWS IAM role ARN for ECR access'
+        required: false
+        default: ''
+        description: 'AWS IAM role ARN for ECR access. Required when push-to-ecr=true (the default).'
     github-token:
         required: true
         description: 'GitHub token for GHCR login'
@@ -33,6 +34,10 @@ inputs:
         required: false
         default: 'true'
         description: 'Whether to push to ghcr.io. Set to false to skip GHCR publishing.'
+    push-to-ecr:
+        required: false
+        default: 'true'
+        description: 'Whether to push to AWS ECR (and assume the AWS role). Set to false for images consumed only via GHCR (e.g. sandbox-host images Modal pulls directly). When false, the AWS configure-credentials + ECR-login steps are skipped, the ECR tag is omitted from the images list, and ecr-registry output is empty.'
 
 outputs:
     tags:
@@ -49,12 +54,14 @@ runs:
     using: 'composite'
     steps:
         - name: Configure AWS credentials
+          if: inputs.push-to-ecr == 'true'
           uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
           with:
               role-to-assume: ${{ inputs.aws-role-to-assume }}
               aws-region: us-east-1
 
         - name: Login to Amazon ECR
+          if: inputs.push-to-ecr == 'true'
           id: aws-ecr
           uses: aws-actions/amazon-ecr-login@f2e9fc6c2b355c1890b65e6f6f0e2ac3e6e22f78 # v2.1.2
 
@@ -85,7 +92,9 @@ runs:
                 if [ "$PUSH_TO_DOCKERHUB" = "true" ]; then
                   echo "posthog/$IMAGE_NAME"
                 fi
-                echo "$ECR_REGISTRY/${ECR_IMAGE_NAME:-$IMAGE_NAME}"
+                if [ "$PUSH_TO_ECR" = "true" ]; then
+                  echo "$ECR_REGISTRY/${ECR_IMAGE_NAME:-$IMAGE_NAME}"
+                fi
                 if [ -n "$LEGACY_IMAGES" ]; then
                   echo "$LEGACY_IMAGES"
                 fi
@@ -98,6 +107,7 @@ runs:
               ECR_IMAGE_NAME: ${{ inputs.ecr-image-name }}
               PUSH_TO_DOCKERHUB: ${{ inputs.push-to-dockerhub }}
               PUSH_TO_GHCR: ${{ inputs.push-to-ghcr }}
+              PUSH_TO_ECR: ${{ inputs.push-to-ecr }}
 
         - name: Docker meta
           id: meta

.github/scripts/smoke-test-agent-bundle.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+#
+# Smoke-test one entrypoint inside the posthog-agents image. Runs the bundle
+# briefly with fake-but-valid env so config parsing succeeds, then expects
+# the service to either reach an I/O dial-out (fine — bundle loaded) or
+# exit on a known boot-time validation error (also fine).
+#
+# Fails the run when the bundle has a load-time problem (missing module,
+# syntax error, wrong path in the build output, native-dep crash) — that's
+# the failure mode local TS dev does NOT catch but the production bundle
+# does, and the whole reason this script exists.
+#
+# Usage: smoke-test-agent-bundle.sh <image-ref> <entrypoint>
+#   <image-ref>   — fully qualified image, e.g.
+#                   795637471508.dkr.ecr.us-east-1.amazonaws.com/posthog-agents@sha256:...
+#   <entrypoint>  — bundle basename without .mjs (ingress, runner, janitor, migrate)
+
+set -euo pipefail
+
+IMAGE_REF="${1:?image-ref required}"
+ENTRYPOINT="${2:?entrypoint required}"
+
+LOG=$(mktemp)
+trap 'rm -f "$LOG"' EXIT
+
+# `--network=none` keeps the container from accidentally reaching anything real;
+# 127.0.0.1:1 is unreachable inside that namespace so connect attempts fail fast
+# with ECONNREFUSED / ENETUNREACH — the exact signal we want.
+docker run --rm \
+    --network=none \
+    -e POSTHOG_DB_URL='postgres://x:x@127.0.0.1:1/x' \
+    -e AGENT_DB_URL='postgres://x:x@127.0.0.1:1/x' \
+    -e AGENT_BUNDLE_S3_BUCKET='smoke-test-bucket' \
+    -e AGENT_BUNDLE_S3_ENDPOINT='http://127.0.0.1:1' \
+    -e AGENT_BUNDLE_S3_ACCESS_KEY_ID='smoke' \
+    -e AGENT_BUNDLE_S3_SECRET_ACCESS_KEY='smoke' \
+    -e AGENT_MEMORY_S3_BUCKET='smoke-test-bucket' \
+    -e AGENT_MEMORY_S3_ENDPOINT='http://127.0.0.1:1' \
+    -e AGENT_MEMORY_S3_ACCESS_KEY_ID='smoke' \
+    -e AGENT_MEMORY_S3_SECRET_ACCESS_KEY='smoke' \
+    -e ENCRYPTION_SALT_KEYS='00beef0000beef0000beef0000beef00' \
+    -e INTERNAL_SECRET='smoke-test-internal-secret' \
+    -e AGENT_INTERNAL_SIGNING_KEY='smoke-test-signing-key' \
+    -e KAFKA_HOSTS='127.0.0.1:1' \
+    -e REDIS_URL='redis://127.0.0.1:1' \
+    -e SANDBOX_BACKEND='modal' \
+    -e MODAL_TOKEN_ID='smoke-modal-token-id' \
+    -e MODAL_TOKEN_SECRET='smoke-modal-token-secret' \
+    -e AGENT_USE_AI_GATEWAY='1' \
+    -e POSTHOG_AI_GATEWAY_URL='http://127.0.0.1:1/v1' \
+    -e POSTHOG_API_BASE_URL='http://127.0.0.1:1' \
+    -e HTTPS_PROXY='http://127.0.0.1:1' \
+    -e NODE_ENV='production' \
+    --entrypoint sh \
+    "$IMAGE_REF" \
+    -c "timeout 5 node products/agent_platform/services/agents/dist/${ENTRYPOINT}.mjs; exit 0" 2>&1 | tee "$LOG" || true
+
+# Bundle-load failures: build is busted. Fail loud.
+if grep -qE 'Cannot find (module|package)|SyntaxError|ReferenceError|TypeError: .* is not a function' "$LOG"; then
+    echo "::error::${ENTRYPOINT} bundle has a load-time error — see logs above"
+    exit 1
+fi
+
+# Bundle loaded fine if we see ANY of:
+#   - the service announced it bound an HTTP port (`"msg":"listening"`) — ingress
+#     and janitor get here without dialling out because they're lazy-connect
+#   - a network dial-out failure (the service got past config + tried to talk to PG/S3/Kafka) —
+#     runner / migrate hit this because they open pools / S3 at boot
+#   - a config-validation throw from zod (config schema rejected our fake values — fine, bundle loaded)
+#   - a clean shutdown after `timeout 5` (rare — most services keep retrying connections)
+if grep -qE '"msg":"listening"|ECONNREFUSED|ETIMEDOUT|ENOTFOUND|ENETUNREACH|getaddrinfo|timed out|invalid_string|invalid_type|ZodError|connection|fetch failed' "$LOG"; then
+    echo "✓ ${ENTRYPOINT} bundle loads and reaches the network/I-O stage"
+    exit 0
+fi
+
+# Empty / immediate-exit logs are the suspicious case: bundle either died
+# silently or never got far enough to log anything. Treat as failure.
+echo "::error::${ENTRYPOINT} produced no recognisable boot output — see logs above"
+exit 1

.github/scripts/verify-storybook-new-stories.sh

@@ -106,10 +106,14 @@ for run in $(seq 1 "$REPEAT_COUNT"); do
     set +e
     # Run test-storybook directly (tests a pre-built storybook dist served over http-server).
     # pipefail is set at script level so tee preserves the exit code.
+    # --passWithNoTests: changed stories may live in a separate storybook
+    # (e.g. services/agent-console, packages/agent-chat) that the main runner's
+    # testMatch doesn't cover. Those are verified by their own CI, so finding no
+    # matching tests here is not a failure.
     pnpm --filter=@posthog/storybook exec test-storybook \
         $snapshot_flag --no-index-json --maxWorkers=1 \
         --browsers chromium \
-        -- --testPathPattern "$pattern" 2>&1 | tee "/tmp/storybook-verify-run${run}.log"
+        -- --testPathPattern "$pattern" --passWithNoTests 2>&1 | tee "/tmp/storybook-verify-run${run}.log"
     exit_code=${PIPESTATUS[0]}
     set -e